EUVD-2026-87268

Zammad is a web based open source helpdesk/customer support system. In 7.0.3 and 7.1.1, under certain conditions, Zammad's verification of inbound PGP-signed email can mark a message as carrying a valid "Good" PGP signature from a registered sender key, even though the displayed message content i...

CVE-2026-67409 RabbitMQ: JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS

RabbitMQ is a messaging and streaming broker. From 3.13.0 until 4.3.3, 4.2.9, 4.1.14, 4.0.23, and 3.13.18, JWKS Fetch Ignores HTTP Response Status Code - Signing Key Destruction Causes Authentication DoS CWE-252. the JWKS key fetching mechanism in uaajwt.erl does not validate the HTTP response...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

UBUNTU-CVE-2026-97567

In the Linux kernel, the following vulnerability has been resolved: mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous timer stop operation...

EUVD-2026-86930

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 are vulnerable to a GraphQL query injection in the export-status component. Specifically, the get_export_status function in src/export_manager.py fails to validate the export_id argument, which is received via the check_rapid7_export_status and ...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

CVE-2026-97228 Rapid7 Bulk Export MCP — GraphQL Query Injection in Export Status Lookup

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

PT-2026-98918

Name of the Vulnerable Software and Affected Versions RabbitMQ versions 3.13.0 through 3.13.17 RabbitMQ versions 4.0.0 through 4.0.22 RabbitMQ versions 4.1.0 through 4.1.13 RabbitMQ versions 4.2.0 through 4.2.8 RabbitMQ versions 4.3.0 through 4.3.2 Description The JWKS key fetching mechanism in...

ROS-20260925-73-0175

The vulnerability in the drivers/scsi/smartpqi/smartpqiinit.c component of the Linux operating system’s kernel is related to insufficient checking of the status of shared resources. Exploiting this vulnerability can allow an attacker to cause service failures...

PT-2026-98461

Name of the Vulnerable Software and Affected Versions Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 Description A GraphQL query injection issue exists in the export-status component within the get export status function in src/export manager.py. The export id variable, which is an unvalidat...

PT-2026-99077

Name of the Vulnerable Software and Affected Versions Zammad versions 7.0.3 and 7.1.1 Description Zammad is a web-based open source helpdesk and customer support system. The software incorrectly verifies inbound PGP-signed emails under certain conditions, marking messages as having a valid PGP...

CVE-2026-97228: Improper Neutralization of Special Elements in Data Query Logic

Rapid7 Bulk Export MCP versions 0.2.5 through 0.6.1 suffer from a GraphQL query injection issue in the export-status component getexportstatus in src/exportmanager.py, whereby the exportid value — an unvalidated MCP tool argument reaching the function via the checkrapid7exportstatus and...

Linux Distros Unpatched Vulnerability : CVE-2026-97567

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - mptcp: prevent race between disconnect and rtx Sashiko noted that the two event can race, leading to inconsistent status. Prevent the race using the synchronous...

SUSE CVE-2026-97500

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

DEBIAN-CVE-2026-97500

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

CVE-2026-97500

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

AZL-103664 CVE-2026-97500 affecting package kernel 6.6.157.1-1

In the Linux kernel, the following vulnerability has been resolved: wifi: rtw89: phy: check length before parsing PHY status IE Hardware might report PHY status IE with unexpected length, and parser might access out of range. Check the length ahead...

CVE-2026-94609

authentik is an open-source identity provider. Prior to 2026.2.7, 2026.5.7, and 2026.8.2, an account with delegated permission to manage a group, group membership, or a user can grant superuser status to an account or assign an existing role to a group without holding the permissions that gate...